Last updated: 8 September 2026
Applies to the Airpay group of companies in India, the United Arab Emirates, Tanzania and Zambia.
“Airpay”, “Airpay Group”, “we”, “our” or “us” refers collectively to Airpay Payment Services Private Limited (“APSPL”) and its subsidiaries, affiliates, associate companies, branches and controlled entities operating in India, the United Arab Emirates (“UAE”), Tanzania, Zambia and other jurisdictions where the Airpay Group provides services.
Airpay Group provides payment processing, payment aggregation, merchant acquiring, financial-technology solutions, cross-border payment services, fraud-prevention solutions and related technology services. This Privacy Policy explains how we collect, use, store, share and protect your personal data, and the rights available to you under the data-protection laws of the jurisdictions in which we operate.
Where a specific Airpay Group entity determines the purposes and means of processing your personal data, that entity is the data controller / data fiduciary responsible for your data in its jurisdiction.
This Policy applies to all persons whose personal data we process in connection with our websites, portals, APIs, mobile applications and services, including but not limited to:
Airpay Group processes personal data in accordance with the applicable data-protection, cybersecurity, payment-system, anti-money-laundering / counter-terrorist-financing (AML/CFT) and consumer-protection laws of each jurisdiction in which it operates, including in particular:
Airpay Group processes personal data in accordance with the applicable data-protection, cybersecurity, payment-system, anti-money-laundering / counter-terrorist-financing (AML/CFT) and consumer-protection laws of each jurisdiction in which it operates, including in particular:
By using Airpay’s websites and services, and, where required by law, by providing your consent through our consent or cookie mechanisms, you consent to the collection and processing of your personal data as described in this Policy. Consent is sought through clear and specific notices. You may withdraw or manage your consent at any time by contacting us at dpo@airpay.in. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal and may limit our ability to provide certain services. Where we rely on a legal basis other than consent (such as legal obligation, contract, or legitimate interest permitted by law), we will process your data on that basis.
Depending on your relationship with us, we may collect the following categories of personal data:
By providing your e-mail address, telephone numbers and other contact information, you agree that Airpay may contact you through one or more modes of communication in connection with the services and this Policy.
We process personal data for the following purposes, among others:
We rely on one or more of the following legal bases, as permitted in each jurisdiction: your consent; performance of a contract with you; compliance with a legal or regulatory obligation; protection of vital interests; and legitimate interests (such as fraud prevention, network and information security, and improving our services) that are not overridden by your rights. Where the DPDP Act applies, we rely on your consent or on “certain legitimate uses” recognised under that Act.
As a regulated payments organisation, Airpay Group continuously monitors accounts and transactions to detect fraud, prevent financial crime, identify suspicious transactions, meet AML/CFT obligations, and protect customers and merchants. Airpay may suspend, refuse, delay, hold, reverse or review transactions, and may suspend accounts, where operational, legal, security or regulatory concerns are identified, in accordance with applicable law.
Access to personal data is granted only to authorised employees, Airpay Group companies, affiliates and authorised agents or service providers, on a need-to-know basis and for legitimate business, compliance and contractual purposes. We may share personal data with:
Airpay does not sell your personal data. We do not disclose specific information about customer accounts to non-affiliated third parties for their independent use, except where: (a) it is necessary to complete a transaction you initiate; (b) you request or authorise it; (c) it is required or directed by law; or (d) you have been informed of the possibility of such disclosure for marketing or similar purposes and given the opportunity to decline.
Cookies are small files stored on your device that help our websites operate efficiently, keep them secure, and provide a better experience. We also use similar technologies such as pixels, tags and local storage. We use the following categories of cookies:
Where required by applicable law, we place non-essential cookies only with your consent, obtained through our cookie banner. You can manage or withdraw your preferences at any time using the cookie management tool on our website or through your browser settings. Blocking some cookies may affect how the website functions. For details of the specific cookies used and their durations, see the cookie management tool. [Insert cookie inventory / link to cookie settings.]
Because Airpay Group operates internationally, your personal data may be transferred to, and processed in, jurisdictions other than your own — including India, the UAE, Tanzania, Zambia and other countries where Airpay or its service providers operate — some of which may not offer an equivalent level of data protection. Where we transfer personal data across borders, we implement appropriate safeguards required by applicable law, such as standard contractual clauses, intra-group agreements, adequacy/whitelisting mechanisms or regulatory approvals, together with technical and organisational measures. By using our services and providing your information, you acknowledge such cross-border transfers, undertaken in accordance with applicable law.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected — including service fulfilment, legal and regulatory compliance, accounting or reporting requirements, fraud monitoring and dispute resolution. Retention periods vary according to the nature of the information and applicable law. Once data is no longer required, we securely delete or anonymise it in line with industry best practice. You may request deletion of your personal data, subject to any legal or contractual obligation that requires us to retain it for a longer period.
Airpay maintains administrative, technical and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encryption, access controls on a need-to-know basis, multi-factor authentication, firewalls and intrusion-detection tools, security monitoring, penetration testing, data-integrity validation, vendor due diligence, regular security audits and incident-response procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
In the event of a personal-data breach, Airpay will notify affected individuals and the relevant supervisory authorities in accordance with applicable law and within the prescribed timelines. Notifications will, where required, describe the nature of the breach, the data involved, the likely consequences and the measures taken to address and mitigate it.
Airpay may deploy artificial intelligence (AI), machine-learning models and automated processing to enhance customer experience, perform risk assessment, detect fraud, improve services and support credit evaluation. Such processing is carried out in a fair, transparent and lawful manner and will not result in unlawful discrimination or an adverse impact without appropriate safeguards. Where required by applicable law, we will obtain your explicit consent before such processing, and, where you have the right, you may request human review of, or object to, decisions based solely on automated processing that produce legal or similarly significant effects.
Airpay may use Model Control Policies (MCP) and governed data-processing frameworks to ensure responsible use, monitoring, validation and auditability of automated systems and data-processing activities, and to support compliance with regulatory standards, data-protection laws and internal risk-management policies.
Our services are not directed at, or intended for, children who are not legally capable of entering into binding agreements under applicable law. Where we process the personal data of a child (in India, an individual under 18) or of a person under guardianship, we will do so only with verifiable consent of a parent or lawful guardian as required by applicable law, and we will not undertake tracking, behavioural monitoring or targeted advertising directed at children, or processing likely to cause a detrimental effect on a child’s well-being. If you believe we have collected a child’s data without appropriate consent, please contact our Data Protection Officer.
To exercise any of these rights, contact our Data Protection Officer at dpo@airpay.in. We will respond within the timelines prescribed by applicable law and may need to verify your identity before acting on a request.
Fraud Alert – Airpay Group will never ask you to:
share an OTP (one-time passcode);
share your password, PIN or CVV;
share your full card number or internet-banking credentials; or
transfer funds to a personal account or install remote-access / screen-sharing apps.
If you receive such a request, it is a scam. Do not respond, and report it immediately to dpo@airpay.in, and to your bank. In India, you may also report to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930.
Safe-usage guidelines: keep your credentials confidential; enable device security and app updates; review your account activity regularly; verify you are on an official Airpay domain before entering information; and report any unauthorised activity immediately.
Airpay Group is committed to the fair treatment of customers, merchants, and stakeholders and operates a transparent complaint-handling process. Grievances covered include payment disputes, service-related complaints, data privacy concerns, fraud-related complaints, account-related requests, and regulatory concerns.
When submitting a grievance, please include your full name, registered email address, mobile number, transaction reference (if applicable), and a detailed description of your complaint.
For complaints, concerns, or queries relating to personal data processing and privacy matters, you may contact the Data Protection Officer (DPO) at: dpo@airpay.in.
If you remain dissatisfied after exhausting our internal grievance process, you may approach the relevant regulatory or supervisory authority in your jurisdiction, subject to applicable law. Timelines will be adjusted where a shorter statutory period applies.
Our websites may contain links to third-party websites. Once you link to another website, this Privacy Policy no longer applies, and Airpay is not responsible for the protection or further disclosure of information on those websites. Please review the privacy statements of any third-party websites you visit. Similarly, links to Airpay’s websites may appear on third-party websites; Airpay is not responsible for the content of, or acts or omissions committed on, such third-party websites.
Airpay may amend this Privacy Policy from time to time. Amended versions will be published on the Airpay website with a revised “Last updated” date. We encourage you to review this Policy periodically. This Policy does not create any contractual or other legal rights or obligations beyond those provided under applicable law. Your continued use of our websites or services after any update constitutes acceptance of the revised Policy, to the extent permitted by law.
For any privacy question or request, contact us at: Data Protection Officer: dpo@airpay.co.in
This Privacy Policy should be read together with the Airpay Group Terms & Conditions. In case of any conflict between the English version and any translation, the English version shall prevail to the extent permitted by applicable law.
